Extracting prog: 23.690462846s
Minimizing prog: 18m15.506281557s
Simplifying prog options: 0s
Extracting C: 21.931648493s
Simplifying C: 5m3.030535119s


extracting reproducer from 30 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCGET6RD-bind$xdp-openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCGET6RD-bind$xdp
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})
r2 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000500)={'syztnl2\x00', &(0x7f0000000480)={'tunl0\x00', <r3=>0x0, 0x80, 0x7, 0x400, 0x1000, {{0xe, 0x4, 0x3, 0x3e, 0x38, 0x68, 0x0, 0xe9, 0x29, 0x0, @multicast2, @private=0xa010100, {[@generic={0x44, 0x2}, @ssrr={0x89, 0x1f, 0x75, [@dev={0xac, 0x14, 0x14, 0x29}, @dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @multicast1, @multicast1, @local, @remote]}]}}}}})
bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x4, r3, 0xb}, 0x10)
openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) (async)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) (async)
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) (async)
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}}) (async)
socket(0x10, 0x3, 0x4) (async)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0) (async)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000500)={'syztnl2\x00', &(0x7f0000000480)={'tunl0\x00', 0x0, 0x80, 0x7, 0x400, 0x1000, {{0xe, 0x4, 0x3, 0x3e, 0x38, 0x68, 0x0, 0xe9, 0x29, 0x0, @multicast2, @private=0xa010100, {[@generic={0x44, 0x2}, @ssrr={0x89, 0x1f, 0x75, [@dev={0xac, 0x14, 0x14, 0x29}, @dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @multicast1, @multicast1, @local, @remote]}]}}}}}) (async)
bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x4, r3, 0xb}, 0x10) (async)

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
single: successfully extracted reproducer
found reproducer with 16 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCGET6RD-bind$xdp-openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCGET6RD
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})
r2 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000500)={'syztnl2\x00', &(0x7f0000000480)={'tunl0\x00', <r3=>0x0, 0x80, 0x7, 0x400, 0x1000, {{0xe, 0x4, 0x3, 0x3e, 0x38, 0x68, 0x0, 0xe9, 0x29, 0x0, @multicast2, @private=0xa010100, {[@generic={0x44, 0x2}, @ssrr={0x89, 0x1f, 0x75, [@dev={0xac, 0x14, 0x14, 0x29}, @dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @multicast1, @multicast1, @local, @remote]}]}}}}})
bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x4, r3, 0xb}, 0x10)
openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) (async)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) (async)
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) (async)
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}}) (async)
socket(0x10, 0x3, 0x4) (async)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0) (async)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000500)={'syztnl2\x00', &(0x7f0000000480)={'tunl0\x00', 0x0, 0x80, 0x7, 0x400, 0x1000, {{0xe, 0x4, 0x3, 0x3e, 0x38, 0x68, 0x0, 0xe9, 0x29, 0x0, @multicast2, @private=0xa010100, {[@generic={0x44, 0x2}, @ssrr={0x89, 0x1f, 0x75, [@dev={0xac, 0x14, 0x14, 0x29}, @dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @multicast1, @multicast1, @local, @remote]}]}}}}}) (async)

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCGET6RD-bind$xdp-openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})
r2 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000500)={'syztnl2\x00', &(0x7f0000000480)={'tunl0\x00', <r3=>0x0, 0x80, 0x7, 0x400, 0x1000, {{0xe, 0x4, 0x3, 0x3e, 0x38, 0x68, 0x0, 0xe9, 0x29, 0x0, @multicast2, @private=0xa010100, {[@generic={0x44, 0x2}, @ssrr={0x89, 0x1f, 0x75, [@dev={0xac, 0x14, 0x14, 0x29}, @dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @multicast1, @multicast1, @local, @remote]}]}}}}})
bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x4, r3, 0xb}, 0x10)
openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) (async)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) (async)
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) (async)
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}}) (async)
socket(0x10, 0x3, 0x4) (async)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0) (async)

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCGET6RD-bind$xdp-openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})
r2 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000500)={'syztnl2\x00', &(0x7f0000000480)={'tunl0\x00', <r3=>0x0, 0x80, 0x7, 0x400, 0x1000, {{0xe, 0x4, 0x3, 0x3e, 0x38, 0x68, 0x0, 0xe9, 0x29, 0x0, @multicast2, @private=0xa010100, {[@generic={0x44, 0x2}, @ssrr={0x89, 0x1f, 0x75, [@dev={0xac, 0x14, 0x14, 0x29}, @dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @multicast1, @multicast1, @local, @remote]}]}}}}})
bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x4, r3, 0xb}, 0x10)
openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) (async)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) (async)
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) (async)
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}}) (async)
socket(0x10, 0x3, 0x4) (async)

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCGET6RD-bind$xdp-openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})
r2 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000500)={'syztnl2\x00', &(0x7f0000000480)={'tunl0\x00', <r3=>0x0, 0x80, 0x7, 0x400, 0x1000, {{0xe, 0x4, 0x3, 0x3e, 0x38, 0x68, 0x0, 0xe9, 0x29, 0x0, @multicast2, @private=0xa010100, {[@generic={0x44, 0x2}, @ssrr={0x89, 0x1f, 0x75, [@dev={0xac, 0x14, 0x14, 0x29}, @dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @multicast1, @multicast1, @local, @remote]}]}}}}})
bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x4, r3, 0xb}, 0x10)
openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) (async)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) (async)
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) (async)
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}}) (async)

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCGET6RD-bind$xdp-openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})
r2 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000500)={'syztnl2\x00', &(0x7f0000000480)={'tunl0\x00', <r3=>0x0, 0x80, 0x7, 0x400, 0x1000, {{0xe, 0x4, 0x3, 0x3e, 0x38, 0x68, 0x0, 0xe9, 0x29, 0x0, @multicast2, @private=0xa010100, {[@generic={0x44, 0x2}, @ssrr={0x89, 0x1f, 0x75, [@dev={0xac, 0x14, 0x14, 0x29}, @dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @multicast1, @multicast1, @local, @remote]}]}}}}})
bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x4, r3, 0xb}, 0x10)
openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) (async)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) (async)
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) (async)

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCGET6RD-bind$xdp-openat$dm_control-ioctl$DM_DEV_CREATE
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})
r2 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000500)={'syztnl2\x00', &(0x7f0000000480)={'tunl0\x00', <r3=>0x0, 0x80, 0x7, 0x400, 0x1000, {{0xe, 0x4, 0x3, 0x3e, 0x38, 0x68, 0x0, 0xe9, 0x29, 0x0, @multicast2, @private=0xa010100, {[@generic={0x44, 0x2}, @ssrr={0x89, 0x1f, 0x75, [@dev={0xac, 0x14, 0x14, 0x29}, @dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @multicast1, @multicast1, @local, @remote]}]}}}}})
bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x4, r3, 0xb}, 0x10)
openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) (async)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) (async)

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCGET6RD-bind$xdp-openat$dm_control
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})
r2 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000500)={'syztnl2\x00', &(0x7f0000000480)={'tunl0\x00', <r3=>0x0, 0x80, 0x7, 0x400, 0x1000, {{0xe, 0x4, 0x3, 0x3e, 0x38, 0x68, 0x0, 0xe9, 0x29, 0x0, @multicast2, @private=0xa010100, {[@generic={0x44, 0x2}, @ssrr={0x89, 0x1f, 0x75, [@dev={0xac, 0x14, 0x14, 0x29}, @dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @multicast1, @multicast1, @local, @remote]}]}}}}})
bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x4, r3, 0xb}, 0x10)
openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) (async)

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCGET6RD-bind$xdp
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})
r2 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000500)={'syztnl2\x00', &(0x7f0000000480)={'tunl0\x00', <r3=>0x0, 0x80, 0x7, 0x400, 0x1000, {{0xe, 0x4, 0x3, 0x3e, 0x38, 0x68, 0x0, 0xe9, 0x29, 0x0, @multicast2, @private=0xa010100, {[@generic={0x44, 0x2}, @ssrr={0x89, 0x1f, 0x75, [@dev={0xac, 0x14, 0x14, 0x29}, @dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @multicast1, @multicast1, @local, @remote]}]}}}}})
bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x4, r3, 0xb}, 0x10)

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCGET6RD
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})
r2 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000500)={'syztnl2\x00', &(0x7f0000000480)={'tunl0\x00', 0x0, 0x80, 0x7, 0x400, 0x1000, {{0xe, 0x4, 0x3, 0x3e, 0x38, 0x68, 0x0, 0xe9, 0x29, 0x0, @multicast2, @private=0xa010100, {[@generic={0x44, 0x2}, @ssrr={0x89, 0x1f, 0x75, [@dev={0xac, 0x14, 0x14, 0x29}, @dev={0xac, 0x14, 0x14, 0x2e}, @broadcast, @multicast1, @multicast1, @local, @remote]}]}}}}})

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket-sendmsg$nl_route_sched
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})
r2 = socket(0x10, 0x3, 0x4)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0xffffffff, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x4, 0x1fc, 0x80000a, 0x1, 0x1, 0x8e06}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x1c, 0xd, 0x1, 0x4, 0xffffffff, 0x34}}, {0x4}}]}]}, 0x68}}, 0x0)

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-socket
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})
socket(0x10, 0x3, 0x4)

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
ioctl$DM_DEV_CREATE(0xffffffffffffffff, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r0=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(0xffffffffffffffff, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(0xffffffffffffffff, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r0}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, 0x0)
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, 0x0)
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program crashed: BUG: unable to handle kernel NULL pointer dereference in snapshot_merge_next_chunks
validation run: crashed=true
reproducing took 26m30.496440392s
repro crashed as (corrupted=false):
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 10fb47067 P4D 10fb47067 PUD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 380 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90000c478d8 EFLAGS: 00010246
RAX: 1ffffffff0d3836f RBX: 1ffff11021f6c331 RCX: dffffc0000000000
RDX: ffffc90000c47980 RSI: ffffc90000c47960 RDI: ffff88810fa19c00
RBP: ffffc90000c47ad0 R08: ffff88810fb619bf R09: 1ffff11021f6c337
R10: dffffc0000000000 R11: ffffed1021f6c338 R12: ffff88810fb619b8
R13: ffff88810fb61988 R14: ffffffff869c1b78 R15: ffff88810fa19c00
FS:  0000555592cef500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000128643000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 snapshot_merge_next_chunks+0x249/0xbb0 drivers/md/dm-snap.c:1064
 start_merge drivers/md/dm-snap.c:1186 [inline]
 snapshot_merge_resume+0x24f/0x2a0 drivers/md/dm-snap.c:2334
 dm_table_resume_targets+0x222/0x360 drivers/md/dm-table.c:2282
 __dm_resume+0x25/0x180 drivers/md/dm.c:2611
 dm_resume+0x1c3/0x240 drivers/md/dm.c:2656
 do_resume drivers/md/dm-ioctl.c:1103 [inline]
 dev_suspend+0x2ae/0x5d0 drivers/md/dm-ioctl.c:1131
 ctl_ioctl drivers/md/dm-ioctl.c:1925 [inline]
 dm_ctl_ioctl+0x8ee/0xca0 drivers/md/dm-ioctl.c:1947
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl+0x121/0x1a0 fs/ioctl.c:739
 __x64_sys_ioctl+0x7b/0x90 fs/ioctl.c:739
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f7c823e5b19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe90bf2a18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f7c8266bfa0 RCX: 00007f7c823e5b19
RDX: 0000200000000740 RSI: 00000000c138fd06 RDI: 0000000000000003
RBP: 00007f7c8247db70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7c8266bfac R14: 00007f7c8266bfa0 R15: 00007f7c8266bfa0
Modules linked in:
CR2: 0000000000000000
---[ end trace 12eaceacbb369369 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90000c478d8 EFLAGS: 00010246
RAX: 1ffffffff0d3836f RBX: 1ffff11021f6c331 RCX: dffffc0000000000
RDX: ffffc90000c47980 RSI: ffffc90000c47960 RDI: ffff88810fa19c00
RBP: ffffc90000c47ad0 R08: ffff88810fb619bf R09: 1ffff11021f6c337
R10: dffffc0000000000 R11: ffffed1021f6c338 R12: ffff88810fb619b8
R13: ffff88810fb61988 R14: ffffffff869c1b78 R15: ffff88810fa19c00
FS:  0000555592cef500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000128643000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

final repro crashed as (corrupted=false):
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 10fb47067 P4D 10fb47067 PUD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 380 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90000c478d8 EFLAGS: 00010246
RAX: 1ffffffff0d3836f RBX: 1ffff11021f6c331 RCX: dffffc0000000000
RDX: ffffc90000c47980 RSI: ffffc90000c47960 RDI: ffff88810fa19c00
RBP: ffffc90000c47ad0 R08: ffff88810fb619bf R09: 1ffff11021f6c337
R10: dffffc0000000000 R11: ffffed1021f6c338 R12: ffff88810fb619b8
R13: ffff88810fb61988 R14: ffffffff869c1b78 R15: ffff88810fa19c00
FS:  0000555592cef500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000128643000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 snapshot_merge_next_chunks+0x249/0xbb0 drivers/md/dm-snap.c:1064
 start_merge drivers/md/dm-snap.c:1186 [inline]
 snapshot_merge_resume+0x24f/0x2a0 drivers/md/dm-snap.c:2334
 dm_table_resume_targets+0x222/0x360 drivers/md/dm-table.c:2282
 __dm_resume+0x25/0x180 drivers/md/dm.c:2611
 dm_resume+0x1c3/0x240 drivers/md/dm.c:2656
 do_resume drivers/md/dm-ioctl.c:1103 [inline]
 dev_suspend+0x2ae/0x5d0 drivers/md/dm-ioctl.c:1131
 ctl_ioctl drivers/md/dm-ioctl.c:1925 [inline]
 dm_ctl_ioctl+0x8ee/0xca0 drivers/md/dm-ioctl.c:1947
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl+0x121/0x1a0 fs/ioctl.c:739
 __x64_sys_ioctl+0x7b/0x90 fs/ioctl.c:739
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f7c823e5b19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe90bf2a18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f7c8266bfa0 RCX: 00007f7c823e5b19
RDX: 0000200000000740 RSI: 00000000c138fd06 RDI: 0000000000000003
RBP: 00007f7c8247db70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7c8266bfac R14: 00007f7c8266bfa0 R15: 00007f7c8266bfa0
Modules linked in:
CR2: 0000000000000000
---[ end trace 12eaceacbb369369 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90000c478d8 EFLAGS: 00010246
RAX: 1ffffffff0d3836f RBX: 1ffff11021f6c331 RCX: dffffc0000000000
RDX: ffffc90000c47980 RSI: ffffc90000c47960 RDI: ffff88810fa19c00
RBP: ffffc90000c47ad0 R08: ffff88810fb619bf R09: 1ffff11021f6c337
R10: dffffc0000000000 R11: ffffed1021f6c338 R12: ffff88810fb619b8
R13: ffff88810fb61988 R14: ffffffff869c1b78 R15: ffff88810fa19c00
FS:  0000555592cef500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000128643000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400